Add Google/Microsoft SSO OAuth for register and sign-in (#24) (#29)

## Summary
- Closes #24 (backend half)
- Add `OAuthIdentity` model (provider + `sub`, access/refresh tokens) for SSO now and Drive reuse later (#11)
- Endpoints: `GET /api/auth/oauth/<google|microsoft>/start/` and `/callback/`
- Create or link `CustomUser` by verified email; issue same JWT access/refresh; redirect FE to `/auth/callback/`
- Document `GOOGLE_OAUTH_*` / `MICROSOFT_OAUTH_*` / `OAUTH_CALLBACK_BASE_URL` in `.env.example` and `.env.prod.example`
- Expose configured providers on `GET /api/public/settings/` as `oauth.google` / `oauth.microsoft`

## Pair with
- Frontend PR: `chat_web_app` branch `feature/sso-oauth-24`

## Test plan
- [ ] `python manage.py test chat_backend.tests.test_oauth`
- [ ] With local Google/Microsoft client IDs set, complete start → IdP → callback → JWT redirect
- [ ] Existing password user with same email links identity (no duplicate)
- [ ] Unverified / missing email redirects with error code
- [ ] Registration disabled: signup start 403; login without account → `account_not_found`
- [ ] Secrets not committed; env examples onlyReviewed-on: #29

.env.example

@@ -28,6 +28,18 @@ CAPTCHA_SECRET_KEY=
 # Self-serve sign-up (default false — set true to allow /user/create/)
 ENABLE_ACCOUNT_REGISTRATION=false
 
+# OAuth SSO — Google / Microsoft (#24). Leave blank to hide SSO buttons.
+# Redirect URIs (register in each IdP console):
+#   {OAUTH_CALLBACK_BASE_URL}/api/auth/oauth/google/callback/
+#   {OAUTH_CALLBACK_BASE_URL}/api/auth/oauth/microsoft/callback/
+GOOGLE_OAUTH_CLIENT_ID=
+GOOGLE_OAUTH_CLIENT_SECRET=
+MICROSOFT_OAUTH_CLIENT_ID=
+MICROSOFT_OAUTH_CLIENT_SECRET=
+MICROSOFT_OAUTH_TENANT=common
+# Optional; defaults to request host. Example local: http://127.0.0.1:8001
+OAUTH_CALLBACK_BASE_URL=http://127.0.0.1:8001
+
 # Stripe / finance (optional local — required for checkout + webhooks)
 STRIPE_SECRET_KEY=
 STRIPE_PUBLISHABLE_KEY=